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The  Isis  project 


This  status  report  covers  activities  of  the  Isis  project  during  the  first  quarter 
of  1992.  This  is  our  l’st  progress  report  under  ONR  funding,  but  because 
these  status  reports  are  intended  to  be  brief  and  our  proposal  was  recently 
funded,  we  assume  that  the  reader  has  some  background  regarding  the  goals 
and  status  of  our  effort,  and  focus  instead  on  technical  accomplishments 
during  the  report  period  and  goals  for  the  next  three  months.  Readers 
unfamiliar  with  our  work  could  start  by  reading  some  of  the  papers  cited 
below,  such  as  TR  1216. 

During  the  report  period,  the  Isis  effort  has  achieved  a  major  milestone  in  its 
effort  to  redesign  and  reimplement  the  Isis  system  using  Mach  and  Chorus  as 
target  operating  system  environments.  In  addition,  we  completed  a  number 
of  publications  that  address  issues  raised  in  our  prior  work;  some  of  these 
have  recently  appeared  in  print,  while  others  are  now  being  considered  for 
publication  in  a  variety  of  journals  and  conferences. 

With  the  completion  of  this  milestone,  we  look  to  1993  as  a  year  during 
which  our  new  system  will  be  implemented  and  fully  integrated  in  to  Mach, 
Chorus,  and  other  microkernel  operating  systems,  and  during  which  a  major 
effort  in  the  real-time  area  will  be  launched. 

The  major  accomplishments  of  this  final  quarterly  report  period  are  as  fol¬ 
lows  (if  this  list  seems  long,  recall  that  ONR  funding  picks  up  from  previous 
DARPA  funding  over  what  is  now  a  six  year  period,  hence  our  project  is  a 
major  one  in  its  mature  stage,  and  can  be  expected  to  be  fairly  productive): 

•  We  completed  the  design  and  prototype  implementation  of  our  new 
“lightweight  groups”  facility,  which  will  eventually  run  in  Mach  or 
Chorus.  This  is  a  major  practical  advance  for  the  group,  which  has 
been  working  on  this  problem  for  the  past  two  years.  Although  our 
new  system  has  yet  to  be  integrated  with  Mach,  it  does  implement  the 
lightweight  causal  and  atomic  multicast  protocols  of  our  1991  ACM 
TOCS  paper,  support  the  causal  domain  model  that  we  introduced  re¬ 
cently,  and  achieves  extremely  high  performance  and  parallelism  even 
over  UNIX.  We  are  extremely  encouraged  by  this  development.  Pre¬ 
dictions  of  a  10-  to  100-fold  performance  improvement  appear  to  be 
justified,  but  until  we  have  this  new  software  running  under  native 
Mach  it  will  be  difficult  to  say  anything  final  on  the  issue. 
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•  We  debugged  the  new  system  to  the  point  of  being  able  to  demonstrate 
it  at  a  recent  research  workshop  sponsored  by  EBM.  The  system  itself 
worked  well,  including  our  new  security  architecture,  described  further 
below. 

•  We  continued  work  on  a  new  way  of  presenting  Isis  groups  that  will 
reduce  costs  by  allowing  Isis  to  map  multiple  application-level  process 
groups  to  a  single  Isis  process  group.  The  idea  here  is  to  amortize 
membership  changes  over  multiple  groups  so  as  to  reduce  their  effective 
cost.  The  technique  us  expected  to  avoid  high  overhead  in  applications 
that  use  very  large  numbers  of  nearly  identical  groups. 

•  Formation  of  research  ties  with  other  laboratories,  including  the  Los 
Alamos  Advanced  Computing  Laboratory  (which  focuses  on  super¬ 
computing),  Portugal’s  INESC  research  laboratory  (known  for  its  work 
on  realtime  communication),  and  with  Mach-related  research  efforts 
at  the  Open  Software  Foundation,  Carnegie  Mellon,  and  University  of 
Arizona. 

•  We  continued  the  development  and  initial  implementation  of  the  new 
security  architecture  for  Isis,  which  focuses  on  securing  islands  of  Isis 
users  within  hostile  networks,  and  on  securing  Isis  abstractions  even 
within  these  islands.  We  view  this  as  an  extremely  important  advance, 
because  the  previous  version  of  Isis  was  almost  completely  trusting  of 
its  users.  The  secure  Isis  architecture,  in  contrast,  can  tolerate  ar¬ 
bitrary  failures  outside  a  collection  of  physically  secure  nodes,  and 
supports  a  highly  sophisticated  trust,  encryption  and  delegation  ar¬ 
chitecture  within  an  island  of  secured  nodes.  Implementation  of  this 
architecture  is  proving  to  be  a  cornerstone  of  our  new  system,  and 
with  the  successful  demonstration  of  the  technology  cited  above,  we 
are  close  to  being  able  to  support  users. 

•  We  completed  the  implementation  of  a  Meta  rule  manager.  This  de¬ 
centralized  Isis  program  can  be  thought  of  as  a  “run-time”  environment 
that  dynamically  loads  Meta  rules  onto  instrumented  components  as 
they  become  active  or  recover  from  crashes.  The  rule  manager  oper¬ 
ates  from  a  description  of  the  instrumented  program  (much  like  the 
schema  of  an  object-oriented  database)  and  allows  a  user  to  make 
simple  queries  about  the  status  of  the  instrumented  program. 
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The  lack  of  such  a  rule  manager  has  been  a  major  stumbling  block  to 
the  clients  of  Meta.  We  are  also  continuing  to  expand  its  function  into 
a  full-fledged  runtime  system.  We  plan  to  add  support  for  interactively 
debugging  active  Meta  rules  and  to  add  graphical  tools  for  monitoring 
the  status  of  the  application. 

•  We  are  completed  the  design  of  a  higher-level  language  for  Meta. 
This  has  proven  to  be  more  difficult  than  we  thought  since  the  dif¬ 
ferences  between  what  appear  to  be  reasonable  semantics  of  temporal 
commands  are  subtle.  The  new  language  is  being  implemented,  and 
will  replace  a  simpler  version  of  Lomita  that  only  supports  Meta-style 
guarded  commands  and  rules  for  maintaining  the  membership  of  ag¬ 
gregates.  This  compiler  produces  object  files  that  are  read  by  the  rule 
manager  mentioned  in  the  previous  item  which  in  turn  activates  rules 
on  the  instrumented  application. 

The  main  drawback  with  the  previous,  simple  version  of  Lomita  is  the 
lack  of  control  flow  structures — for  example,  recovery  when  some  con¬ 
trol  rule  terminates  abnormally.  Hence,  we  are  extending  the  function 
of  the  Meta  shell  actuator  to  allow  sensor  values  to  be  passed  in  as 
environment  variables.  Combined  with  a  shell  command  that  accesses 
Meta  (also  nearing  completion),  this  will  allow  a  programmer  to  write 
shell  scripts  that  are  invoked  by  Meta  as  actuators.  Such  scripts  can 
both  record  state  for  temporal  matching  and  perform  complex  control 
functions  by  using  both  Unix  features  and  Meta  sensors  and  actuators. 

•  Almost  all  of  the  applications  that  Meta  has  been  used  for  outside  of 
Cornell  have  used  the  sensor  abstractions  of  Meta  much  more  than 
the  actuator  abstractions.  We  think  that  part  of  this  is  due  to  the 
lack  of  rule  support  mentioned  above,  but  it  is  also  somewhat  due 
to  the  lack  of  a  good  example  that  could  be  distributed  with  Meta. 
Hence,  we  have  built  such  an  example  application  that  uses  Meta 
to  load  balance  requests  to  a  set  of  simulated  computation  servers. 
Writing  this  application  has  (not  unexpectedly)  flushed  out  a  set  of 
subtle  bugs  in  Meta  and  Isis,  and  so  the  example  application  is  not 
ready  for  distribution  at  the  time  this  report  was  written.  It  currently 
exhibits  simple  rules  (such  as  transparent  submission  to  lightly-loaded 
servers)  and  we  are  currently  adding  more  complex  control  rules  (such 
as  dynamic  server  creation  and  removal  based  on  average  service  load). 
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We  are  also  rewriting  the  Isis  Resource  Manager  as  a  Meta  client. 
Again,  this  has  flushed  out  a  set  of  problems  with  Meta  (most  no¬ 
tably,  the  lack  of  support  for  remote  Isis  and  the  lack  of  support  of 
large  aggregates).  We  expect  to  have  the  Isis  Resource  Manager  fully 
functional  as  a  Meta  client  by  the  end  of  1992. 

•  We  have  made  substantial  progress  in  a  new  experimental  effort  to 
understand  flow  control  problems  on  hardware  multicast  technologies 
such  as  ethemet,  FDDI  and  token  ring,  and  are  extending  our  work 
to  include  next-generation  technologies  such  as  ATM.  The  goal  of  this 
effort  is  to  develop  effective  flow-control  algorithms  for  use  within  the 
Isis  multicast  protocols.  So  far,  we  have  focused  on  collecting  data  con¬ 
cerning  the  behavior  of  the  raw  devices  themselves,  and  have  obtained 
fascinating  and  non-intuitive  results  concerning  packet  loss  rates  in  a 
number  of  settings.  These  show  that  the  most  significant  loss  rates  are 
for  small  packets  sent  in  many-one  or  many-many  situations.  Low  or 
zero  loss  occurs  with  large  packets  and  for  one-many  patterns.  This 
information  will  be  used  to  develop  algorithms  that  narrow  in  on  the 
situations  in  which  loss  rates  are  highest,  while  remaining  uninvolved 
in  other  situations.  Such  flow  control  algorithms  are  the  key  element 
limiting  Isis  performance  on  many  systems,  and  development  of  this 
new  flow  control  software  will  be  a  small  but  critical  activity  for  us 
during  the  coming  year. 

•  We  have  initiated  a  new  project  to  explore  specialized  implementations 
of  Isis  for  the  CM/5  and  Intel  Touchstone  multiprocessors.  This  work 
is  motivated  by  the  impressive  results  of  Berkeley’s  Split/C  and  Ac¬ 
tive  Messages  research,  demonstrating  that  asynchronous  communica¬ 
tion  can  lead  to  tremendous  performance  gains  on  the  most  important 
emerging  parallel  processors.  As  we  move  Isis  onto  these  platforms, 
we  want  to  build  our  protocols  in  ways  that  exploit  the  hardware  fully 
and  minimize  unnecessary  work  in  software  -  work  needed  on  networks 
but  not  on  closely  coupled  machines.  We  are  very  excited  about  this 
new  direction. 

•  Finally,  and  last  only  because  the  effort  is  one  that  started  recently, 
we  have  begun  to  explore  the  integration  of  realtime  support  into  Isis, 
through  a  project  called  CORTO.  Our  goals  are  fairly  modest  for  this 
effort,  at  least  initially,  because  we  wish  to  build  something  usable 
which  we  can  later  extend  with  sophisticated  schedulers  and  other 
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adjuncts.  In  the  near  term,  CORTO  will  focus  on  adding  periodic 
process  groups  and  realtime  group  communication  to  Isis. 

With  this  first  progress  report,  it  is  interesting  to  observe  that  Isis  seems 
also  at  the  end  of  a  period  of  initial  transition.  The  original  version  of  Isis 
is  no  longer  a  subject  of  active  research  at  Cornell,  and  the  initial  version 
of  the  Meta  system  is  also  finished.  With  the  successful  handoff  of  these 
systems  to  ISIS  Distributed  Systems  (and  the  widespread  release  of  public, 
source- form  distributions),  technology  transition  for  this  version  of  ISIS  is 
well  established,  and  Cornell  is  now  free  to  focus  on  the  development  of  the 
next  generation  of  this  technology. 

Users  of  the  first  generation  technology  include  Sematech,  Hughes  (EOS), 
GE/Motorola  (Iridium),  the  military  (HiperD),  the  financial  community 
(New  York  Stock  Exchange,  World  Bank,  many  banks  and  brokerages), 
CERN,  Los  Alamos,  FermiLab,  GTE,  Southwestern  Bell  Telephone,  and 
many  other  large  and  small  companies,  both  for  commercial  and  for  re¬ 
search  purposes.  DARPA  and  Nasa,  though  support  for  Isis,  have  created  a 
new  technology  that  is  clearly  having  an  enduring  impact  on  the  way  that 
distributed  systems  are  developed  in  the  United  States  and  worldwide. 

On  the  research  side,  the  success  of  Isis  and  Meta  have  launched  a  major 
wave  of  activity  in  the  O/S  community.  Hundreds  of  papers  have  been 
written  by  dozens  of  research  groups  on  variations  of  the  Isis  approach.  The 
technology  can  only  improve  from  this  type  of  activity,  and  there  can  be  no 
clearer  proof  that  the  approach  is  valid  and  viable. 

Our  own  redesign  of  Isis  has  been  structured  around  a  much  simplified  core  of 
protocols  and  system  management  routines  (a  sort  of  “micro-kernel”).  This 
core  is  flexible  enough  to  support  all  existing  Isis  functionality,  as  well  as  real¬ 
time  applications,  secure  applications,  a  version  of  the  Isis  toolkit  optimized 
for  parallel  processing  environments,  and  support  for  object-oriented  and 
modular  programming  languages,  like  C++  and  ADA.  We  are  building  this 
new  software  layer  so  that  it  can  run  directly  over  the  Mach  and  Chorus 
kernels,  while  continuing  to  support  a  UNIX-level  interface  similar  to  our 
current  toolkit  interface. 

A  final  comment  relates  to  our  continued  and  enlarging  discussions  with 
industry.  We  are  now  actively  pursuing  standardization  of  the  Isis  approach 
to  group  computing  with  Unix  Systems  Laboratories,  Unix  International,  the 
Open  Software  Foundation,  the  Texas  Instruments/DARPA  OODB  project, 


7 


Electronic  Joint  Venture,  and  other  standards  organizations.  This  is  having 
significant  impact,  as  demonstrated  by  the  decision  of  OSF  to  integrate  Isis 
into  OSF  1/AD  and  the  recent  announcements  by  Unix  International  and 
USL  concerning  the  key  role  that  reliable  process  group  technologies  will  play 
in  their  future  products.  We  are  increasingly  joined  by  'ndustry  strategists 
in  recognizing  Isis  and  META  as  enablers  for  a  whole  new  generation  of 
highly  reliable,  large-scale,  self-managing  distributed  software.  We  believe 
that  DARPA  and  ONR  can  point  to  this  emerging  trend  as  a  demonstration 
of  the  huge  impact  that  government  research  activities  cam  have  on  industry, 
given  sufficient  time,  sufficient  investment,  and  consistently  positive  results 
to  point  to. 
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Wood.  September  1990.  Proceedings  of  the  Fourth  ACM  SIGOPS  Euro¬ 
pean  Workshop,  (1990),  1-4. 

90-1136*  Tools  for  Distributed  Application  Management.  Keith  Marzullo,  Robert 
Cooper,  Mark  Wood  and  Kenneth  Birman.  IEEE  Computer,  24,  8, 
(August  1991),  42-51. 

89- 997  Implementing  Fault-Tolerant  Sensors.  Keith  Marzullo.  May  1989.  Sub¬ 

mitted  for  publication. 

ISIS/META  Activity 

90- 1103  ISIS  and  Meta  Projects:  Progress  Report.  Kenneth  Birman,  Robert 

Cooper  and  Keith  Marzullo.  February  1990. 

89- xxx  The  ISIS  Distributed  Programming  Toolkit  and  The  Meta  Distributed 

Operating  System.  Ken  Birman  and  Keith  Marzullo.  SUN  Technology 
2, 1,  (Summer  1989). 
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85-694  Reliable  Communication  in  the  Presence  of  Failures.  Kenneth  Birman 
and  Thomas  Joseph.  July  1985.  (Revised  August  1986).  ACM  Trans¬ 
actions  on  Computer  Systems ,  5,  1,  (February  1987),  47-76. 

85-668  Replication  and  Fault-Tolerance  in  the  ISIS  System.  Kenneth  Birman. 
March  1985  (Revised  September  1985).  10th  ACM  Symposium  on  Op¬ 
erating  Systems  Principles ,  (December  1985),  79-86.  Operating  Systems 
Review ,  19,  5,  (December  1985). 

84-644  Low-Cost  Management  of  Replicated  Data  in  Fault-Tolerant  Distributed 
Systems.  Kenneth  Birman  and  Thomas  Joseph.  October  1984.  ACM 
Transactions  on  Computer  Systems,  4,  1,  (February  1986),  54-70. 

84-642  An  Overview  of  the  ISIS  Project.  Kenneth  Birman,  A.  El  Abbadi,  W. 

C.  Dietrich,  Thomas  Joseph  and  T.  Raeuchle.  October  1984.  IEEE 
Distributed  Processing  Technical  Committee  Newsletter.  January  1985. 

84-594  Implementing  Fault-Tolerant  Distributed  Objects.  Kenneth  Birman, 
Thomas  Joseph,  T.  Raeuchle,  and  A.  El  Abbadi.  4th  Symposium  on 
Reliability  in  Distributed  Systems  and  Database  Systems,  Silver  Springs, 
MD,  October  1984.  IEEE  Transactions  on  Software  Engineering,  SE- 
11,  6,  (June  1985),  502-508. 

83-552  ISIS:  An  Environment  for  Constructing  Fault-Tolerant  Distributed  Sys¬ 
tems.  Kenneth  Birman,  D.  Skeen,  A.  El  Abbadi,  W.  C.  Dietrich  and  T. 
Raeuchle.  May  1983. 

META  Activity 

92-1277*  Using  Consistent  Subcuts  for  Detecting  Stable  Properties  (replaces  TR 
91-1205).  Keith  Marzullo,  Laura  Sabel.  April  1992. 

91-1252*  Fault-Tolerant  Management  of  Distributed  Applications  Using  the  Re¬ 
active  System  Architecture.  PhD  Thesis.  Mark  Wood.  December  1991. 

91-1238*  Putting  Time  into  Proof  Outlines.  Fred  B.  Schneider,  Bard  Bloom  and 
Keith  Marzullo.  September  1991. 

91-1221*  Detection  of  Global  State  Predicates.  Keith  Marzullo  and  Gil  Neiger. 

November  1991.  To  appear  in  Proceedings  of  the  Fifth  Workshop  on 
Distributed  Algorithms  and  Graphs,  (Springer- Verlag),  Delphi,  Greece, 
October  1991. 
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88-928  The  Use  of  Efficient  Broadcast  Protocols  in  Asynchronous  Distributed 
Systems.  Prank  Schmuck.  (Ph.D.  Thesis).  August  1988. 

88-918  Reliable  Broadcast  Protocols.  Chapter  14  in  Distributed  Systems, 
Thomas  Joseph  and  Kenneth  Birman.  June  1988.  Sape  J.  Mullender, 
ed.,  Addison- Wesley/ ACM  Press  Series  (1989). 

88-917  Exploiting  Replication.  Chapter  15  in  Distributed  Systems,  Thomas 
Joseph  and  Kenneth  Birman.  June  1988.  Sape  J.  Mullender,  ed., 
Addison- Wesley/ACM  Press  Series  (1989). 

87-849  ISIS  -  A  Distributed  Programming  Environment,  Version  2.1  -  User’s 
Guide  and  Reference  Manual.  Kenneth  Birman,  Thomas  Joseph  and 
Prank  Schmuck.  July  1987. 

87-811  Exploiting  Virtual  Synchrony  in  Distributed  Systems.  Kenneth  Birman 
and  Thomas  Joseph.  February  1987.  11th  ACM  Symposium  on  Oper¬ 
ating  Systems  Principles,  December  1987.  Also  appearing  in  Operating 
Systems  Review,  22,  1,  (December  1987),  123-138. 

86-781  Efficient  Concurrency  Control  for  Libraries  of  Typed  Objects.  T. 
Raeuchle.  (Ph.D.  Thesis).  September  1986. 

86-772  Programming  with  Shared  Bulletin  Boards  in  Asynchronous  Distributed 
Systems.  Kenneth  Birman,  Thomas  Joseph  and  Pat  Stephenson.  August 
1986.  (Revised  December  1986). 

86-753  Communication  Support  for  Reliable  Distributed  Computing.  Kenneth 
Birman  and  Thomas  Joseph.  Lecture  Notes  in  Computer  Science  (1990), 
124-137.  Proc.  Asilomar  Workshop  on  Fault  Tolerant  Distributed  Com¬ 
puting,  March  1986. 

86-744  ISIS:  A  System  for  Fault-Tolerance  in  Distributed  Systems.  Kenneth 
Birman.  April  1986. 

85-712  Low  Cost  Management  of  Replicated  Data.  Thomas  Joseph.  (Ph.D. 
Thesis).  November  1985. 


PUBLICATIONS  LIST  Continued 

91-1192*  Lightweight  Causal  and  Atomic  Group  Multicast.  Kenneth  Birman,  An¬ 
dre  Schiper  and  Pat  Stephenson.  February  1991.  ACM  Transactions  on 
Computer  Systems,  9,  3,  (August  1991),  272-314. 

91-1188*  Using  Process  Groups  to  Implement  Failure  Detection  in  Asynchronous 
Environments.  Aleta  Ricciardi  and  Kenneth  Birman.  ACM  Symposium 
on  Principles  of  Distributed  Computing ,  Montreal,  Quebec,  Canada, 
(August  19-21,  1991),  341-353.  Principles  of  Distributed  Computing 
(1991),  341-353. 

90-1165*  Designing  Application  Software  in  Wide  Area  Network  Settings.  Mesaac 
Makpangou,  Kenneth  Birman.  October  1990. 

90-1138*  The  ISIS  Project:  Real  Experience  with  a  Fault  Tolerant  Programming 
System.  Kenneth  Birman  and  Robert  Cooper.  Operating  Systems  Re¬ 
view,  (April  1991),  103-107.  ACM/SIGOPS  European  Workshop  on 
Fault- Tolerance  Techniques  in  Operating  Systems,  Bologna,  Italy,  1990. 

90-1105R*  Fast  Causal  Multicast.  Operating  Systems  Review  (April  1991),  75-79. 

Kenneth  Birman,  Andre  Schiper  and  Pat  Stephenson.  March  1990.  Re¬ 
vised  February  1991.  New  TR  91-1192.  New  title:  Lightweight  Caused 
and  Atomic  Group  Multicast.  To  appear  in  ACM  TOCS. 

89-1067  Log-Based  Recovery  in  Asynchronous  Distributed  Systems.  Kenneth 
Kane.  December  1989. 

89-1042  Deceit:  A  Flexible  Distributed  File  System.  Alex  Siegel,  Kenneth  Bir¬ 
man  and  Keith  Marzullo.  November  1989. 

89-xxxx  Supporting  Large  Scale  Applications  on  Networks  of  Workstations. 

Robert  Cooper  and  Kenneth  Birman.  April  1989.  Second  Workshop 
on  Workstation  Operating  Systems,  Asilomar,  CA,  September  1989. 

89-1014  How  Robust  are  Distributed  Systems.  Kenneth  Birman.  June  1989.  An 
Advanced  Course  on  Distributed  Systems  -  lecture  notes  from  Artie  ’88, 
Addison-Wesley,  1989.  To  be  published. 

89-1001  The  Role  of  Order  in  Distributed  Programs.  Kenneth  Birman  and  Keith 
Marzullo.  March  1989.  Submitted  for  publication. 

88-949  Causally  Consistent  Recovery  of  Partially  Replicated  Logs.  Kenneth 
Birman  and  Kenneth  Kane.  November  1988.  Submitted  for  publication. 
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ISIS  Activity 

92-xxxx*  Light-Weight  Process  Groups.  Bradford  B.  Glade,  Kenneth  P.  Birman, 
Robert  C.  B.  Cooper  and  Robbert  van  Renesse.  Proceedings  of  the  Open- 
Forum,  ’92  Technical  Conference,  November  1992,  323-336. 

92-xxxx*  A  RISC  Approach  to  Process  Groups.  Robbert  van  Renesse,  Robert 
Cooper,  Bradford  Glade,  Patrick  Stephenson.  Proceedings  of  the  5th 
ACM  SIGOPS  Workshop,  Rennes,  France,  September  21-23,  1992. 

92-1289*  Using  the  ISIS  Resource  Manager  for  Distributed,  Fault-Tolerant  Com-, 
puting.  Timothy  Clark  and  Kenneth  Birman.  June  1992 

92-1287*  How  to  Securely  Replicate  Services.  Michael  Reiter  and  Kenneth  Bir¬ 
man.  June  1992.  Submitted  to  ACM  Transactions  on  Programming 
Languages  and  Systems. 

92-xxxx  Reliable  Multicast  between  Microkernels.  Robbert  van  Renesse,  Ken 
Birman,  Robert  Cooper,  Brad  Glade,  and  Pat  Stephenson.  Proceedings 
of  the  USENIX  Workshop  on  Micro-Kernels  and  Other  Kernel  Architec¬ 
tures,  Seattle,  Washington,  April  27-28,  1990,  269-283. 

92-1269*  Integrating  Security  in  a  Group  Oriented  Distributed  System  (replaces 
1239).  Michael  Reiter,  Kenneth  Birman,  and  Li  Gong.  February  1992. 
Also  in  the  Proceedings  of  the  1992  IEEE  Symposium  on  Research  in 
Security  and  Privacy,  Oakland,  CA,  (May  1992),  18-32. 

92-xxxx  The  Cost  of  Order  in  Asynchronous  Systems.  Aleta  Ricciardi,  Ken  Bir¬ 
man,  and  Pat  Stephenson.  Springer-  Verlag  Lecture  Notes  in  Computer 
Science,  1992. 

91-1240*  Maintaining  Consistency  in  Distributed  Systems.  Kenneth  Birman.  Oc¬ 
tober  1991.  Submitted  to  Journal  of  Parallel  and  Distributed  Comput¬ 
ing. 

91-1233*  Practical  Utility  of  Knowledge-Based  Analyses:  Optimizations  and  Op¬ 
timality  for  an  Implementation  of  Asynchronous,  Fail-Stop  Processes. 
Aleta  M.  Ricciardi.  September  1991.  To  appear  in  the  Proceedings  of 
the  Fourth  Conference  on  the  Theoretical  Aspects  of  Reasoning  About 
Knowledge ,  (1992). 

91-1216*  The  Process  Group  Approach  to  Reliable  Distributed  Computing.  Ken¬ 
neth  P.  Birman.  July  1991.  To  appear  in  the  Communications  of  the 
ACM. 


Publications 


On  the  following  pages,  we  reproduce  a  full  list  of  publications  by  the  effort, 
including  some  very  recent  ones  as  well  as  earlier  work.  A  good  general  re¬ 
view  of  the  project  is  TR  1216,  soon  to  be  published  by  the  Communications 
of  the  ACM.  We  are  beginning  work  on  a  book  that  will  collect  the  most 
important  papers  into  a  single  volume.  Where  a  paper  has  appeared  in  a 
journal,  the  TR  version  will  often  be  out  of  date,  since  copyright  restrictions 
prevent  us  from  distributing  versions  of  these  papers  for  which  copyright 
has  been  assigned  to  the  journal.  These  revisions  are  often  important,  so 
where  a  journal  version  is  cited,  we  urge  the  potential  reader  to  consult  the 
journal  itself  and  not  to  rely  on  the  older  TR  copy  stated  on  the  list. 

Future  progress  reports  will  include  only  new  publications. 


